Over the last decade, network devices that access the Internet or other publicly accessible networks have been increasingly targeted for malicious attack. These malicious attacks may simply involve the use of stolen credentials by an unauthorized person in efforts to gain unauthorized access to information stored within a network device. However, other malicious attacks may be more complex.
In general, one type of malicious attack is an exploit attack. An exploit attack is an attempt, normally through unsuspecting uploading of an exploit (e.g., software, data, command(s), etc.) to take advantage of a vulnerability in a targeted computer by adversely influencing or attacking normal operations of that computer. Typically, exploit attacks are directed to a vulnerability associated with a specific application (e.g., browser application, document reader application (such as a portable document format “PDF” reader), Microsoft® Office® or another type of data processing application, etc.) or a vulnerability found in a specific plug-in associated with the application (e.g., Flash™ plug-in, Java® runtime environment (“JRE”), etc.).
Another type of malicious attack may involve the insertion of malicious software into a computer or another type of computing device. The malicious software may include any program or file that is harmful by design to the computing device. The malicious software may include computer viruses, worms, Trojan horses, adware, spyware, and any programming that gathers or attempts to steal information from a computer or about its user or otherwise operates without permission. The owners of the computers are often unaware that these programs have been added to their computers and are often similarly unaware of their function.
Various processes and devices have been employed to prevent malicious attacks and other security threats. For example, computers often run antivirus scanning software that scans a particular computer for viruses and other forms of malware. The scanning typically involves automatic detection of a match between content stored on the computer (or attached media) and a library or database of signatures of known malware. However, this type of static analysis produces a number of false negatives, as detection is solely dependent on the presence of generated signatures, which may not be available until weeks or months after initial detection of a particular type of malware.
Another type of threat detection solution employs virtual machine instances (VMs) to replay the processing of an object within a sandbox established by those VMs. This solution monitors the behavior of the object during processing within a VM and may signal that the object (e.g., uniform resource locator, a file, etc.) is associated with a malicious attack in response to detecting anomalous behavior(s). One such system offered by FireEye, Inc., the assignee of the present patent application, employs a two-phase malware detection approach to detect malware contained in network traffic monitored in real-time. In a first or “static” phase, a heuristic is applied to an object that appears to be “suspicious” by exhibiting characteristics associated with malware. In a second or “dynamic” phase, the suspicious objects are processed within one or more virtual machines and in accordance with a specific version of an application or multiple versions of that application. Although the two-phase, malware detection solution may offer concurrent processing of two or more versions of an application in order to achieve significant reduction of false positives while limited time for analysis, this analysis may not take into account the totality of the software environment when analyzing the content for malware.